PAYMENT SYSTEMS OVERSIGHT UNIT OPERATIONAL FRAMEWORK PSOU/OPFK/001 Version 2.0 6 August 2014 PSOU/OPFK/001 Ver 2.0 6 August 2014 1
COPYRIGHT The Central Bank of the UAE retains copyright in this document. This document may not be reproduced, transmitted electronically or otherwise, in whole or in part, without the express permission of the Central Bank. PSOU/OPFK/001 Ver 2.0 6 August 2014 2
DISTRIBUTION HE The Governor of the Central Bank HE The Assistant Governor of the Central Bank HE The Deputy Governor of the Central Bank Executive directors of the Central Bank PSOU/OPFK/001 Ver 2.0 6 August 2014 3
REVISION HISTORY V 0.1 23 August 2009 First draft V 0.2 2 September 2009 PSOU review V 0.3 21 September 2009 Banks systems in scope V 0.4 30 September 2009 Clarify scope of work Refer to questionnaires Refer to related documentation V 1.0 22 November 2009 Refer to payment instruments Document released V 2.0 6 August 2014 Amendments for release of Principles for Financial Market Infrastructures PSOU/OPFK/001 Ver 2.0 6 August 2014 4
TABLE OF CONTENTS 1. INTRODUCTION... 6 2. ROLE OF THE CENTRAL BANKS... 6 3. THE PRINCIPLES... 6 5. AUTHORITY OF THE PSOU... 7 5.1 SYSTEMS OVERSIGHT... 7 5.2 STRATEGIC INITIATIVES... 8 6. COMMUNICATIONS... 8 7. SUPPORT SERVICES... 8 8. SCOPE OF WORK... 9 8.1 CENTRAL BANK SYSTEMS... 9 8.2 NON-CENTRAL BANK SYSTEMS... 9 8.3 PARTICIPATING BANKS SYSTEMS... 9 8.4 PAYMENT INSTRUMENTS... 10 8.5 NON-BANKING ORGANISATIONS... 10 9. ASSESSMENT METHODS... 10 9.1 GATHERING INFORMATION... 11 9.2 INSPECTING AND TESTING SYSTEMS... 12 9.3 CO-OPTING RESOURCES... 12 9.4 SELF-ASSESSMENT... 12 9.5 COOPERATING WITH OTHER CENTRAL BANKS... 12 10. SANCTIONS... 13 11. ASSESSMENT REPORTS... 13 12. CONCLUSION... 14 13. REFERENCES... 14 PSOU/OPFK/001 Ver 2.0 6 August 2014 5
1. Introduction Payment and settlement systems (otherwise known as Financial Market Infrastructures) are essential components of a market economy. At its simplest, buyers and sellers must be confident that their transactions will be completed in a safe and efficient manner. However, all payment systems face certain risks such as: Credit when a buyer is unable to settle Liquidity when a buyer is unable temporarily to settle Operational when a system failure delays settlement Legal when an existing law overrides a buyer s obligation to settle A failure to settle can undermine the stability of both financial markets and government monetary policy. Thus, the Central Bank has established a Payment Systems Oversight Unit (PSOU) to monitor the UAE s payment systems and to ensure that risks are identified and managed. 2. Role of the Central Banks As a serious settlement failure can affect the government s wider economic and monetary policies central banks around the world have assumed responsibility for overseeing payment systems. The Bank for International Settlements (BIS) agrees that oversight should be a central bank function and has identified five areas of responsibility, viz. 1. Payment systems should be subject to appropriate and effective oversight 2. The Central Bank should have the powers and resources to carry out their responsibilities 3. The Central Bank should clearly define and disclose its oversight policies 4. The Central Bank should adopt the BIS s Principles for Financial Market Infrastructures (see below) and, as a minimum, apply them consistently to all systemically important payment systems 5. The Central Bank should cooperate with relevant domestic and international regulators to promote the safety and efficiency of payment systems. The Payment Systems Oversight Unit was established by the Central Bank in April 2009 to undertake and implement the above responsibilities. 3. The Principles The Principles for Financial Market Infrastructures were developed jointly by the Bank for International Settlements Committee on Payment and Settlement Systems and the International PSOU/OPFK/001 Ver 2.0 6 August 2014 6
Organisation of Securities Commissions. There are 24 principles but only the following apply to payment systems in the UAE: 1. Legal basis 9. Money settlements 2. Governance 3. Framework for the management of risks 12. Exchange of value settlement systems 13. Participant default rules & procedures 4. Credit risk 15. General business risk 5. Collateral 16. Custody and Investment Risks 7. Liquidity risk 17. Operational Risk 8. Settlement finality 18. Access and participation requirements 19. Tiered participation arrangements 20. FMI Links 21. Efficiency and effectiveness 22. Communication, procedures and standards 23 Disclosure of rules, key procedures & market data Table 1: PFMI Principles Applicable to Payment Systems. The Principles are defined fully elsewhere but see, in particular, the PSOU s PFMI Assessment Methodology 5. Authority of the PSOU The PSOU derives its authority and powers from the Central Bank. 5.1 Systems Oversight All payment systems in the UAE are potentially subject to PSOU oversight and must be certified by the PSOU in order to provide payment and settlement services. Any system already in operation as at 14 April 2009 (the date the PSOU was established) shall be granted a certificate. Thereafter, any new system offered by an existing or new operator must be certified by the PSOU prior to entering service. The PSOU shall issue a certificate if, overall, the system is at least broadly compliant with the Principles. Broadly compliant means that the PSOU takes into account the level of risk, the impact of failure upon the wider economy, and the availability of alternative payment systems. PSOU/OPFK/001 Ver 2.0 6 August 2014 7
5.2 Strategic Initiatives The PSOU shall support efforts to promote new payment systems, channels and instruments in order to reduce costs, provide more options for banks and their customers, and to make the market more competitive. 6. Communications The PSOU considers effective and timely communications an essential feature of the Central Bank s leadership role in providing both oversight of and direction to the payments market. To this end, the PSOU shall ensure that its role and responsibilities are made known within the Central Bank and throughout the wider market. The PSOU shall make every effort to ensure that market participants are kept informed of plans and schedules so that they, in turn, can make their views and requirements known to the Central Bank. The PSOU recognises that such ongoing liaison is necessary to allow participants time to schedule their own development activities and resources so as to take participate fully in the evolution of Central Bank systems. In keeping with its preferred partnership approach the PSOU shall continue to post all relevant documents on its Web site and these shall be available to all participants. In the interests of protecting commercial confidentiality the PSOU may communicate directly and privately with participants. In order to ensure best practice and that the UAE s payment systems remain at the forefront of market developments the PSOU shall establish close working relationships with other central banks and with international standards organisations such as the Bank for International Settlements in Basle. 7. Support Services The PSOU will assist banks, service providers and other interested parties to become compliant with the Principles. The PSOU will: Establish ongoing communications Provide information Respond to queries Facilitate workshops Review system designs PSOU/OPFK/001 Ver 2.0 6 August 2014 8
The above list is by no means exclusive as the PSOU welcomes and encourages the involvement of all interested parties. 8. Scope of Work The Principles are directed specifically at systemically important payment systems i.e. those whose failure would have serious consequences throughout the financial market. Systemically important systems tend to be those facilitating large-value payments and thus normally exclude retail systems. However, at least initially, the PSOU takes a broader approach and includes prominent retail systems which may become more important in the future. The PSOU assesses these systems using the same Principles but may impose a less rigorous schedule for the correction of any defects. The following paragraphs refer to current systems and services. However, the PSOU is authorised to oversee any payment system whether established now or in the future. 8.1 Central Bank Systems The PSOU will assess existing Central Bank systems: The funds transfer system (UAEFTS) The image cheque clearing system (ICCS) The direct debit system (UAEDDS) The electronic switch (UAESWITCH) The payment gateway (UAEPGS) The two systemically important payment systems assessed by the PSOU are UAEFTS and ICCS. 8.2 Non-Central Bank Systems The PSOU will assess systems and services operated by other organisations, such as: Third-party service providers Mobile and Internet payment services Domestic card schemes e.g. Mercury International card schemes e.g. Visa, MasterCard and American Express 8.3 Participating Banks Systems PSOU/OPFK/001 Ver 2.0 6 August 2014 9
Some Central Bank systems such as UAEFTS and UAESWITCH require on-line access by the participating banks. The security of these networks and their participants may be compromised should even one connecting system be non-secure. Hence, the PSOU shall mandate minimum operational and technical security standards for connecting to Central Bank systems. Such mandates may be extended to include manual systems such as ICCS. Here, the PSOU might stipulate minimum standards for the safe storage and transfer of cheques. 8.4 Payment Instruments In the view of the PSOU payment instruments are integral to and inseparable from their systems and, therefore, subject to PSOU oversight. The PSOU s main concern is with security such as anti-fraud features and compliance with international standards. 8.5 Non-Banking Organisations An increasing number of non-banking organisations provide systems and services to the UAE market. The PSOU will assess (or liaise with) them in order to develop a wider community of interest. The following organisations have been identified so far: Payment gateway operators Card transaction processors Terminal providers Card manufacturers Card personalisation bureaux It is acknowledged that equipment suppliers are not directly involved in payment systems. However, they are included here because their cooperation will be required should EMV become mandatory. It is further acknowledged that these companies require certification by the relevant card schemes. 9. Assessment Methods The main methods of working are to gather information and to carry out site surveys. The PSOU may request documents from and interviews with system operators and their participants. In sum, the PSOU may inspect any relevant document, process or procedure and shall always define a payment system in broad terms i.e. beyond the operator s central computer system. In carrying out its assessment the PSOU may: Request information from system operators Issue questionnaires Inspect and test systems PSOU/OPFK/001 Ver 2.0 6 August 2014 10
Co-opt specialised resources Request a self-assessment Cooperate with other central banks Take comments from system participants Monitor the service Undertake follow-up assessments 9.1 Gathering Information Information provided by system operators is a major asset for the PSOU so must be: Timely Comprehensive Not misleading After an initial meeting the PSOU will meet payment system operators on a regular basis to discuss issues arising and, if appropriate, progress towards greater compliance with the Principles. Prior to this first meeting, operators shall provide the following information: Name of settlement system(s) Major system functions Organisations using the system Rules and regulations Settlement basis Risk mitigation and management strategy Value of transactions during previous quarter (minimum, maximum, average) Volume of transactions during previous quarter Maximum participant exposure, permitted and achieved Peak periods Contingency arrangements System availability Availability of participants systems (if relevant) System scalability Capacity planning Thereafter, organisations shall provide on a quarterly basis: Value of transactions during previous quarter (minimum, maximum, average) Volume of transactions during previous quarter Maximum participant exposure, permitted and achieved Details of any deviations from the rules PSOU/OPFK/001 Ver 2.0 6 August 2014 11
Availability of system and of participants systems Any information that might affect compliance with the Principles. NB Payment system operators must notify the PSOU immediately of any event arising that might incur systemic risk or otherwise affect their system s compliance with the Principles. During the course of its assessments the PSOU might seek confidential information. In all cases the Central Bank shall respect commercial confidentiality and shall only share confidential information with other regulators and if required to do so. 9.2 Inspecting and Testing Systems If requested, operators of systems being assessed should cooperate with the PSOU. Such cooperation might include, for example, work-shops, demonstrations and testing the system in the presence of the PSOU. This cooperation is essential to the efficacy of the PSOU. Obviously, operators are more familiar with their systems than are the PSOU especially if the system has been developed in-house. 9.3 Co-Opting Resources At times, oversight requires specialised legal, audit, technical, financial and operational risk skills. If necessary, the PSOU will co-opt appropriate resources from within the Central Bank or hire external consultants to provide the requisite expertise. 9.4 Self-Assessment The PSOU may request an organisation to assess its own compliance with the Principles. In these cases the organisation shall submit a comprehensive report to the PSOU whereupon the PSOU may either accept the findings or require they be audited and tested. If not satisfied, the PSOU reserves the right to undertake its own assessment. 9.5 Cooperating with Other Central Banks In accordance with BIS recommendations the PSOU will coordinate its oversight activities with other central banks. This will certainly be the case with regards to assessing any company processing foreign currency transactions where the PSOU will partner with the issuers of those currencies. PSOU/OPFK/001 Ver 2.0 6 August 2014 12
The PSOU will also work closely with other GCC central banks through the GCC Payment Systems Committee which reports to the Committee of GCC Governors. All GCC member states have undertaken to share knowledge and to collaborate in devising consistent oversight policies. 10. Sanctions Whereas the PSOU is seeking collaborative relationships it is clear that any oversight function requires effective sanctions in extreme cases. The Central Bank has many powers in law and in convention that may be brought to bear and these are available to the PSOU. In general, the PSOU may impose by regulation any requirement aimed at improving the safety and efficiency of payment systems. If the PSOU is not satisfied with an operator s compliance status this will be communicated to the operator in writing together with a date by which a remedy must be in place. If the date is missed without reasonable explanation then the PSOU may take any of the following actions: Impose a fine Temporarily suspend the operator s certificate Revoke the operator s certificate In practice, the PSOU expects that informal sanctions should suffice. For example, a report will be published each year detailing the extent of all systems compliance with each of the Principles; the PSOU believes participants will wish to avoid bad publicity. 11. Assessment Reports The PSOU shall provide copies of its status reports to senior managers of the systems assessed. Where relevant, copies of the report shall be sent to partner central banks. Compliance with each Principle shall be rated as: Fully-compliant Broadly-compliant Partially-compliant Non-compliant Not applicable Where appropriate, the report shall include analyses and recommendations. PSOU/OPFK/001 Ver 2.0 6 August 2014 13
12. Conclusion The Central Bank intends that national payment systems should be of a standard commensurate with the high quality of infrastructure found elsewhere in the UAE s economy. In this context the PSOU will play a leading role in initiating the changes needed to support a world-class business environment. This document describes the work of the PSOU at a high level and should be read in conjunction with the PSOU s related document PFMI Assessment Methodology. This latter document describes in detail the oversight criteria and the way in which the PSOU arrives at its overall assessment of a system. This framework document has benefited from documents published by the BIS and other central banks. Thus, in terms of payment systems oversight, the PSOU believes its proposed framework to be both typical and appropriate for the UAE. 13. References The following publications were referenced in the preparation of this document: PFMI Assessment Methodology Central Bank, Payment Systems Oversight Unit Principles for financial market infrastructures (PFMI) Bank for International Settlements CPSS - ISOCO, April 2012 Assessment methodology for the principles for FMIs and the responsibilities of authorities Bank for International Settlements CPSS - ISOCO, April 2012 Disclosure framework for financial market infrastructures (Consultative report) Bank for International Settlements CPSS - ISOCO, April 2012 Disclosure framework and Assessment methodology Bank for International Settlements CPSS - ISOCO, December 2012 Principles for Systemically Important Payment Systems Bank for International Settlements, January 2001 Central Bank Oversight of Payment and Settlement Systems PSOU/OPFK/001 Ver 2.0 6 August 2014 14
Bank for International Settlements, May 2005 Report of the Committee on Interbank Netting Schemes (Lamfalussy Report) Bank for International Settlements, November 1990 Role of the Eurosystem in the field of payment systems oversight European Central Bank, June 2000 Oversight standards for euro retail payment systems European Central Bank, June 2003 Oversight framework for card payment schemes standards European Central Bank, January 2008 Federal Reserve Policy on Payment Systems Risk Federal Reserve Board, December 2008 Payment Systems Oversight Report, 2008 Bank of England, April 2009 Detailed Assessments of Payment Systems, 2008 Bank of England, April 2009 PSOU/OPFK/001 Ver 2.0 6 August 2014 15